DNS TXT records

who knew they were so complex

SEAN K.H. LIAO

DNS TXT records

who knew they were so complex

TXT

Sure DNS might be the distributed key-value store of choice, perhaps even something to base your next filesystem off of, but those TXT records sure can be finicky.

The format is define in RFC 1035 Section 3.3.14.

So you can have multiple TXT records, and within each record, you can have multiple strings up to 255 bytes each (+1 length byte). If you have a string longer than 255 bytes, you can break it up into shorter segments, and clients should be able to recombine them. Most(?) DNS hosts are smart enough to split it for you but some require you to do it manually cough Google Cloud DNS cough

Ex: gmail's current DKIM keys, note the value is returned as 2 quoted strings.

 1$ drill TXT 20161025._domainkey.gmail.com
 2;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 54894
 3;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
 4;; QUESTION SECTION:
 5;; 20161025._domainkey.gmail.com.	IN	TXT
 6
 7;; ANSWER SECTION:
 820161025._domainkey.gmail.com.	299	IN	TXT	"k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAviPGBk4ZB64UfSqWyAicdR7lodhytae+EYRQVtKDhM+1mXjEqRtP/pDT3sBhazkmA48n2k5NJUyMEoO8nc2r6sUA+/Dom5jRBZp6qDKJOwjJ5R/OpHamlRG+YRJQqR" "tqEgSiJWG7h7efGYWmh4URhFM9k9+rmG/CwCgwx7Et+c8OMlngaLl04/bPmfpjdEyLWyNimk761CX6KymzYiRDNz1MOJOJ7OzFaS4PFbVLn0m5mf0HVNtBpPwWuCNvaFVflUYxEyblbB6h/oWOPGbzoSgtRA47SHV53SwZjIsVpbq4LxUW9IxAEwYzGcSgZ4n5Q8X8TndowsDUzoccPFGhdwIDAQAB"
 9
10;; AUTHORITY SECTION:
11
12;; ADDITIONAL SECTION:
13
14;; Query time: 9 msec
15;; SERVER: 127.0.0.53
16;; WHEN: Tue Jul 27 23:28:34 2021
17;; MSG SIZE  rcvd: 462

Ex: my terraform config for DKIM in Google Cloud DNS, note it's a single record that's space separated (hence the need for quotes) split at less than 255:

 1locals {
 2  medea_dkim = "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3R2wlknuJGSUG6St2MBKoD2/BlCt0yA1LpYBRy7rw+uaiePMJHEUM5LZPTsgM6uz0PaRN2u+wOg0ulPdpKhdn5LylX5mEtM+kGBIya2QTsBVDEzgoecOj+sdufVB43sPRXSEdzav+bMv4nvMYtMPbNX1hlk8GEvnMooHB85tDL7LipK26rdc/gIy39kiMqHJavPae3CsMIZiNG6D4oMtePFz9yPlQmm9LVVvCqPTqKvR6Rva3nFTLVBUrO7U4FlKWa+/4VdE89SNDzrZshkSTq6fJ75eA8TRzi0jwwT4silfNXpMnloy4hMC3NHibr9ftAncuRLm1zbWy4LLfFlbmQIDAQAB"
 3}
 4
 5resource "google_dns_record_set" "TXT__default__domainkey_medea" {
 6  managed_zone = google_dns_managed_zone.medea.name
 7  name         = "default._domainkey.${google_dns_managed_zone.medea.dns_name}"
 8  type         = "TXT"
 9  rrdatas = [
10    "\"${substr(local.medea_dkim, 0, 253)}\" \"${substr(local.medea_dkim, 253, -1)}\"",
11  ]
12  ttl = 1
13}